2 ms·
> If the hash of a password is in the HIBP database, the plaintext password is out there somewhere in a database of a malicious actor. My understanding this is
by that_guy_iain 3y ago
> If the hash of a password is in the HIBP database, the plaintext password is out there somewhere in a database of a malicious actor.
My understanding this isn't true. These leaks are often just the password hashes.
- Digit-Al 3y agoThere are some leaks where passwords are cracked and included in plaintext and there are some leaks where passwords are not cracked and included only as hashes. If the leak includes cracked passwords in plaintext then they will be added to HIBP and can be checked, otherwise they are not included and cannot be checked.